I've enabled the moderation option in my QuoteIt settings, yet users have somehow been able to bypass it and their quotes show up right away on the page. What could be the problem here?

Moderate Quotes is set to YES.

That is strange. Try saving the options again and try creating a new user and adding a quote with that account. Does it still get automatically approved? A link to your site might help, too.

Is it feasible to be able to add additional fields to quote entries? I wish to add a URL reference field and a media file path field.

I don't have time to do it right now, but it shouldn't be that hard. Just add the appropriate database columns, then add the fields in the quote_listbit and quote_manager templates and a little bit of code in quotes.php to insert the fields in the right columns.

The quotes and randomquote BBCodes are not functional on my board, though they have been in the past. No content of any nature appears. I double checked the settings, and they are turned on. I saved all QuoteIt options, rebuilt bitfields, re-uploaded all files and re-imported the product. No dice. The BBCodes are there, but the Replacement fields are blank. Furthermore, the randomquote BBCode entries are stripped entirely from the post content after saving.

UPDATE #1
I deleted the BBCodes and repeated all procedures above. Now the quotes BBCode is functional, but the randomquote is still defunct.

UPDATE #2
Perhaps I spoke too soon. The quotes BBCode appears to be functional after first saving and displaying post content, however it reverts back to displaying plain text tags thereafter. When viewing the BBCodes within the BBCode manager of ACP, it displays {Q1201967627:42} in the HTML and Replacement columns for quotes and {R1201967627:0} for these respective fields for randomquote. When you edit both quotes and randomquote BBCodes, the Replacement box is empty.

UPDATE #3
I have discovered that the quotes BBCode is working only on quick replies and quick edits, and only when first displaying the post immediately thereafter. Refreshing the page or going back later to view the post reverts to plain text tags (ie "[quotes]246[/quotes]". Again, randomquote disappears regardless.

Ooh, that random quote does look pretty broken, although I don't see what you mean about the [quotes] BBCode. I'm not sure what update caused that problem, but I'll take a look at it tomorrow. Ignore the BBCodes in the admincp, though. That was originally just an example and probably should have been taken out. :o

Thanks for taking a look, Steve. As for the [quotes] BBCode, it appears to work upon preview and the first display of a quick reply or quick edit. However, if you refresh the post or go back later, it reverts to text as if the BBCode is unrecognized.

Ok, it appears that something changed with the removal of empty BBCodes. For the time being, just put anything between the randomquote tags, like this:
I still can't duplicate the [quotes] problem, though. I'd like to try it on your site, do you want to make a hidden forum or something so I can test it out?

This resulted in a blank post, though it does now retain the BBCode instead of having it stripped.I'm OK with a public test. You can delete your post when finished, or I can clean it up later.
As for the forum, how about this one:
http://www.ligotti.net/forumdisplay.php?f=86

Thanks again!

Try reuploading the latest files and reinstalling (without uninstalling) the product. If that doesn't work, edit the "Finalize BBCode" plugin that uses the "newpost_preview" hook and replace this:

with this:

Then try previewing a post with a few [quotes] and [randomquote] bbcodes in it and tell me what the output is. This will break the post preview, so undo the edit after you're done.